AMENDMENTS TO THE DRAWINGS: 



The attached sheet of drawings includes changes to Figure 1 ; specifically reference 
numerals 122 and 124 have been removed. This sheet, which includes Figure 1, replaces the 
original sheet including Figure 1 . 
Attachment: Replacement Sheet 
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REMARKS 

Claims 1, 18, 19, 20, and 21 have been amended to clarify the subject matter regarded as 
the invention. Claims 1-16 and 18-21 are pending. 

The objections to the drawings are believed to overcome by the replacement drawing for 
Figure 1 and the amendment to the description of Figure 4. The specification has been amended 
in a manner believed to overcome the objections to the specification, with the exception of the 
objection to the portion at p. 10, 1. 4, regarding which the office action appears to request that 
word "offset" should be replaced by the same word. 

The claims have been amended in a manner believed to overcome the objections to the 
claims. Claims 18 and 19 have been amended in a manner believed to overcome the rejections 
under 35 USC 1 12. Claim 21 has been amended in a manner believed to overcome the rejection 
under 35 USC 101. 

Claims 1-16 and 18-21 stand rejected under 35 U.S.C. 103(a) as being unpatentable over 
Pochon in view of Cantrell. The rejection is respectfully traversed. With respect to claims 1, 20, 
and 21, Pochon describes detecting anomalies, such as "fragmentation ambiguity" (paragraph 
[0020]) and "fragmentation overlap" (paragraph [0022] and following), but Pochon teaches 
modifying, redirecting, or discarding fragments when anomalies are detected, paragraph [0051], 
which is not the same as initiating "expanded buffering of fragments contained in" fragmented 
network traffic in response to detecting an anomaly, as recited in claims 1, 20, and 21. In fact, 
discarding fragments under such circumstances, as taught by Pochon, is the opposite of initiating 
expanded buffering and therefore storing more of such fragments for a longer time, as recited in 
claims 1, 20, and 21. Cantrell describes assembling fragments at an inline security device into 
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"normalized" packets, forwarding the packets (instead of the fragments originally sent) to the 
destination, and in the case of suspicious traffic setting aside and performing further processing 
on the normalized packets, not the original fragments. Cantrell [0026], [0057], [0062]-[0065]. 
Assembling fragments into normalized packets and setting aside for further analysis normalized 
packets determined to be suspicious is not the same thing as initiating expanded buffer of 
fragments, as recited in claims 1, 20, and 21 . In any case, one of ordinary skill in the art would 
not think to combine Pochon and Cantrell as suggested in the office action, since Pochon's 
teaching of discarding fragments determined to be suspicious teaches away from setting aside 
and performing further processing on suspicious traffic as described by Cantrell. As such, claim 
1, 20, and 21 are believed to be allowable. 

Claims 2-16, 18, and 19 depend from claim 1 and are believed to be allowable for the 
same reasons described above. 

The foregoing amendments are not to be taken as an admission of unpatentability of any 
of the claims prior to the amendments. 

Reconsideration of the application and allowance of all claims are respectfully requested 
based on the preceding remarks. If at any time the Examiner believes that an interview would be 
helpful, please contact the undersigned. 



Respectfully submitted, 





William J. James 
Registration No. 40,661 



V 408-973-2592 
F 408-973-2595 



VAN PELT, YI & JAMES LLP 
10050 N. Foothill Blvd., Suite 200 
Cupertino, CA 95014 
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